What is a man-in-the-middle attack and which prevention measures are most effective?

• A. Intercepts communications by positioning between two endpoints; prevent with TLS, certificate pinning, mutual TLS, and network controls.
• B. Exploits phishing to steal credentials; prevent with MFA.
• C. Sniffs traffic on a shared network hub; prevent with regular password changes.
• D. Injects malware into a system to harvest keys; prevent with antivirus software.

Answer: (A)

A man-in-the-middle attack happens when an attacker positions themselves between two communicating parties, secretly relaying, decrypting, or modifying their messages without either side realizing it. The strongest defense combines encryption, strong authentication, and network controls so that even if traffic is diverted, the content remains unread and the parties can verify who they’re talking to.

Using TLS between the client and server ensures the data in transit is encrypted, so intercepted messages aren’t readable. Certificate pinning goes a step further by validating that the server’s certificate matches a known, trusted key, reducing the risk of a forged certificate being used to impersonate the server. Mutual TLS authenticates both ends, requiring valid certificates for both the client and the server, which makes it much harder for an attacker to impersonate one side. Network controls—such as proper segmentation, monitoring for unusual traffic, preventing rogue devices, and using VPNs or controlled TLS inspection where appropriate—help detect or block MITM attempts and enforce trusted paths.

Phishing-focused credential theft, while serious, is not a MITM in-transit interception. Regular password changes don’t address the interception risk on a network, and malware-based key harvesting is a different attack vector that antivirus coverage alone doesn’t prevent.